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CLAIM LISTING 

This listing of claims will replace all prior versions, and 
listings of claims in the application: 

In the Claims 

Please cancel claim 1 without prejudice. 

1. (canceled) 

2. (currently amended) A method of protecting a design for 
configuring a PLD comprising the steps ofj_*p 

loading an encrypted bitstream representing the design into 
the PLD; 

decrypting the bitstream in the PLD to produce an 
unencrypted bitstream representing the design; 

configuring the PLD with the unencrypted bitstream; and 
disabling the PLD from being partially reconfigured. 

3. (currently amended) The method - PLD of Claim 2 wherein the 
step of disabling the PLD from being partially reconfigured 
also prevents part of a user's design from being relocated to 
another part of the PLD. 

4. (new) The method of claim 2, further comprising disabling 
readback of configuration data from the PLD after configuring 
the PLD with the unencrypted bitstream. 

5. (new) The method of claim 4, further comprising: 

loading decryption keys into the PLD; 

disabling the readback of the configuration data in 
response to a first state of a security status signal 
indicating that the decryption keys are protected; and 

enabling the readback of the configuration data in 
response to a second state of the security status signal 
indicating that the decryption keys are unprotected. 
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6. (new) The method of claim 5, further comprising: 

establishing the security status signal in the first state 
prior to loading the decryption keys into the PLD; and 

establishing security status signal in the second state 
after loading the decryption keys into the PLD and before the 
loading of the encrypted bit stream. 

7. (new) The method of claim 2, wherein the configuration 
bitstream includes encrypted configuration data and encrypted 
configuration memory addresses. 

8. (new) An apparatus for protecting a design for configuring a 
PLD , compr i s ing : 

means for loading an encrypted bitstream representing the 
design into the PLD; 

means for decrypting the bitstream in the PLD to produce an 
unencrypted bitstream representing the design; 

means for configuring the PLD with the unencrypted 
bitstream; and 

means for disabling the PLD from being partially 
reconfigured. 

9 . (new) A method for configuring a programmable logic device 
(PLD) , comprising: 

storing a plurality of decryption keys in storage elements 
of the PLD; 

receiving a configuration bitstream at the PLD, wherein 
the configuration bitstream includes control data and 
configuration data and at least the configuration data is 
encrypted; 

decrypting the configuration bitstream in the PLD using 
the plurality of decryption keys to generate a decrypted 
configuration bitstream; 

storing configuration data from the decrypted 
configuration bitstream in configuration memory of the PLD; 
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disabling readback of configuration data from the PLD 
after storing the configuration data in configuration memory; 
and 

disabling partial reconfiguration of the PLD in response 
to decryption of the configuration bitstream. 

10. (new) The method of claim 9, further comprising accepting 
only a single write instruction in the configuration bitstream 
in response to a control portion of the configuration bitstream 
indicating decrypted configuration data. 

11. (new) The method of claim 9, further comprising: 

disabling the readback of the configuration data in 
response to a first state of a security status signal 
indicating that the decryption keys are protected; and 

enabling the readback of the configuration data in 
response to a second state of the security status signal 
indicating that the decryption keys are unprotected. 

12. (new) The method of claim 11, further comprising: 

establishing the security status signal in the first state 
prior to loading the decryption keys into the PLD; and 

establishing the security status signal in the second 
state after loading the decryption keys into the PLD and before 
the receiving of the encrypted bitstream. 

13. (new) An apparatus for configuring a programmable logic 
device (PLD) , comprising: 

means for storing a plurality of decryption keys in 
storage elements of the PLD; 

means for receiving a configuration bitstream at the PLD, 
wherein the configuration bitstream includes control data and 
configuration data and at least the configuration data is 
encrypted; 
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means for decrypting the configuration bitstream in the 
PLD using the plurality of decryption keys to generate a 
decrypted configuration bitstream; 

means for storing configuration data from the decrypted 
configuration bitstream in configuration memory of the PLD; 

means for disabling readback of configuration data from 
the PLD after storing the configuration data in configuration 
memory; and 

means for disabling partial reconfiguration of the PLD in 
response to decryption of the configuration bitstream. 

14. (new) A programmable logic device (PLD), comprising: 

a configuration memory; 

programmable logic circuitry coupled to the configuration 
memory; 

a key management circuit adapted for storage of a 
plurality of keys; 

a configuration circuit coupled to the configuration 
memory and to the plurality of storage elements, the 
configuration circuit adapted to configure the configuration 
memory with an input configuration bitstream, and to disable 
partial reconfiguration of the PLD and disable readback of 
configuration data from the PLD responsive to input of an 
encrypted configuration bitstream, decryption of the encrypted 
configuration bitstream, and configuration with the decrypted 
configuration bitstream; and 

a decryptor coupled to the configuration circuit and to 
the plurality of storage elements, the decryptor configured to 
decrypt, responsive to the configuration circuit, an input 
configuration bitstream using a plurality of decryption keys 
stored in the plurality of storage elements. 

15. (new) The PLD of claim 14, further comprising: 

wherein the key management circuit is adapted to generate, 
responsive to an input instruction, a security status signal 
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having a state that indicates whether the decryption keys are 
protected; and 

wherein the configuration circuit is further adapted to 
disable the readback of the configuration data in response to a 
first state of the security status signal and enable the 
readback of the configuration data in response to a second 
state of the security status signal. 

16. (new) The PLD of claim 15, wherein the PLD has a boundary 
scan port, and the input instruction is input via a boundary 
scan port. 
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